CVE-2021-38511
📋 TL;DR
This vulnerability in the Rust tar crate allows attackers to create arbitrary directories outside the intended extraction path when processing TAR archives containing symlinks. It affects any Rust application using the tar crate to extract untrusted archives. The issue enables directory traversal attacks via specially crafted symlinks.
💻 Affected Systems
- Rust tar crate
📦 What is this software?
Tar by Tar Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker could overwrite critical system files, install backdoors, or achieve remote code execution by writing malicious files to sensitive locations.
Likely Case
Data corruption, denial of service, or privilege escalation through file manipulation in application directories.
If Mitigated
Limited to directory creation without file content control if proper sandboxing exists.
🎯 Exploit Status
Exploitation requires only a crafted TAR archive; no authentication needed if application accepts external archives.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.36 and later
Vendor Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0080.html
Restart Required: No
Instructions:
1. Update Cargo.toml to specify tar >= 0.4.36. 2. Run 'cargo update -p tar'. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Validate archive paths before extraction
allImplement custom validation to reject archives containing symlinks or path traversal attempts.
Implement Rust code to inspect archive entries before extraction
Use sandboxed extraction directory
allExtract archives to isolated, temporary directories with restricted permissions.
Use tempfile crate to create secure temporary directories
🧯 If You Can't Patch
- Disable TAR archive processing from untrusted sources
- Implement strict input validation rejecting archives with symlinks
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock for tar version < 0.4.36 or run 'cargo tree | grep tar'Check Version:
grep -A2 'name = "tar"' Cargo.lock | grep versionVerify Fix Applied:
Confirm tar version >= 0.4.36 in Cargo.lock and test extraction with malicious archives📡 Detection & Monitoring
Log Indicators:
- Unexpected directory creation outside extraction path
- Failed symlink resolution errors
Network Indicators:
- Inbound TAR archive uploads followed by unusual file system activity
SIEM Query:
source="application.log" AND "tar extraction" AND ("symlink" OR ".." OR "directory traversal")